What is the CVSS score of CVE-2026-14424?

CVE-2026-14424 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-14424?

A critical sandbox escape vulnerability in Google Chrome for macOS (CVE-2026-14424, CVSS 9.6) allows remote attackers to fully compromise affected systems by tricking users into visiting a malicious…. A patch is available.

How to fix or mitigate CVE-2026-14424?

Within 24 hours: Enable automatic Chrome updates across all macOS endpoints and alert users to the critical vulnerability. Within 7 days: Verify all macOS systems have updated Chrome to version 150.0.7871.46 or later and confirm automatic updates are functioning. Within 30 days: Conduct security audit to confirm 100% compliance with Chrome version 150.0.7871.46 or later and establish Chrome update baseline.

Google Chrome CVE-2026-14424

EUVD-2026-41199 CRITICAL

Use After Free (CWE-416)

2026-07-01 Chrome

GHSA-hmqr-q436-x68f

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page (AV:N, PR:N) requires only a page visit (UI:R); sandbox escape crosses a trust boundary (S:C) with total host impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 01:22 vuln.today

CVSS changed

Jul 02, 2026 - 00:22 NVD

9.6 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.46) stems from a use-after-free in Dawn, Chrome's WebGPU/graphics abstraction layer, and allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox and gain higher-privileged code execution on the host. The flaw is rated High by Chromium and carries a CVSS 9.6 due to its network attack vector, low complexity, and scope change. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, and CISA's SSVC framework currently marks exploitation as 'none' though technical impact as 'total'.

Technical ContextAI

The vulnerable component is Dawn, Chromium's implementation of the WebGPU standard that translates web-facing GPU API calls into native backend calls (Metal on macOS). WebGPU exposes low-level GPU functionality to JavaScript, giving web content a large and complex attack surface that runs partly in the GPU process. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference to it remains reachable, and subsequent access to that stale pointer can be manipulated to corrupt memory. Because the corruption occurs in a component that bridges the sandboxed renderer and more privileged GPU/system code, successful exploitation is characterized as a sandbox escape rather than a mere renderer compromise. The affected product per CPE is cpe:2.3:a:google:chrome (all versions before the fix), specifically the macOS build.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 150.0.7871.46 or later on macOS, per the Chrome Stable Channel Update advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); Chrome's built-in updater will apply this automatically on relaunch, so ensure users fully restart the browser. Because the vulnerability lives in the WebGPU/Dawn path, an interim compensating control until patching is complete is to disable WebGPU (for example via the chrome://flags/#enable-unsafe-webgpu and related GPU flags, or enterprise policy), which removes the vulnerable attack surface at the cost of breaking any WebGPU-dependent web applications and hardware-accelerated GPU features. Enforcing update deployment through enterprise management (Chrome Browser Cloud Management / MDM) is preferable to ad-hoc user updates for fleet coverage. No separate workaround is required once the fixed version is deployed.